Sheherazade’s Tale of the Three Judges

Tale of the Three Judges

An example of stepwise developmentof security protocols

Annabelle McIver Carroll Morgan

Sheherazade’s

The three-judges protocol

3

Three judge ‘bots communicate over the internet to reach a verdict by majority: but no judge’s individual decision is to be revealed.

3JP The three-judges protocol


3


2P∧ 2P∨ OT

Two-party disjunction

Two-party conjunction

Oblivious transfer

3JP

Oblivious transfer



3


2P∧ 2P∨ OT

OT OT



Oblivious transfer

Oblivious transfer

Oblivious transfer

3JP

Oblivious transfer



3


2P∧ 2P∨ OT

OT OT



Oblivious transfer

Oblivious transfer

Oblivious transfer

3JP

Encryption lemmaEL

Oblivious transfer


hid Bool b, c

reveal b ∧ c


4

hid Bool b, c

reveal b ∧ c


Agent B reveals a Boolean b1 and Agent C reveals a Boolean c0 such that the exclusive-or b1⊕c0 is the conjunction b⋀c.

But neither b nor c is itself revealed in the process.

specification

classical refinement

plus secure refinement

The Lovers’

Protocol

4

hid Bool b, c

reveal b ∧ c

skip


5

hid Bool b, c

reveal b ∧ c

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1


Encryption Lemma

A common component of many protocols of this sort, including the Dining Cryptographers (Chaum) and the Oblivious Transfer (Rabin/Rivest).

6

reveal b ∧ c

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1


7

reveal b ∧ c

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1


8

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1


reveal b � c � false

9

IFELSE

(b1 ⊕ b2) � c � (b1 ⊕ b1)

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1


reveal

10

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1


reveal b1 ⊕ (b2 � c � b1)

11

b2 � c � b1

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1


reveal

12

b2 � c � b1

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1


reveal

13

replace bysubprotocol

b2 � c � b1c0 :=

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1


14

a subprotocol

b2 � c � b1c0 :=

|[

]|

hid Bool c0

reveal

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1


c0

14

a subprotocol

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1

hid Bool c0

c0 := b2 � c � b1

reveal c0


15

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1

hid Bool c0

c0 := b2 � c � b1

reveal c0

B holds these


15

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1

hid Bool c0

c0 := b2 � c � b1

reveal c0

B holds these

C holds this


15

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1

hid Bool c0

c0 := b2 � c � b1

reveal c0

B holds these

C holds this

B does these}


15

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1

hid Bool c0

c0 := b2 � c � b1

reveal c0

B holds these

C holds this

B does these

C does this

}


15

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1

hid Bool c0

c0 := b2 � c � b1

reveal c0

B holds these

C holds this

B does these

C does this

Oblivious Transfer

}


Due to Rabin; we use Rivest’s formulation. An algebraic derivation of it is given inThe Shadow Knows. Carroll Morgan. Sci. Comp. Prog. 2009, to appear.

15

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1

hid Bool c0

c0 := b2 � c � b1

reveal c0

B holds these

C holds this

B does these

C does this

Oblivious Transfer

}

Two-party conjunction:

16

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1

hid Bool c0

c0 := b2 � c � b1

reveal c0

B holds these

C holds this

B does these

C does this

Oblivious Transfer

}

Two-party conjunction: externally viewed

16


Variables’ names usually indicate where they are located, i.e. which agent “owns” them. It’s an informal convention in this talk. It can of course be made precise with annotations, but we don’t bother.

as seen by B

On the other hand, we do bother for visibility attributes: an agent sometimes can see variables owned by others, and sometimes cannot.

c0 := b2 � c � b1

|[

]|

b1 ⊕ b2 := b reveal b1

hid Bool c0

reveal c0


;;

hid Bool c

vis Bool b

vis Bool b1, b2

as seen by B

18

|[

]|

hid Bool b1, b2


reveal c0;;

hid Bool b

vis Bool c

vis Bool c0

c0 := b2 � c � b1


19

|[

]|

hid Bool b1, b2


reveal c0;;

hid Bool b

vis Bool c

vis Bool c0

c0 := b2 � c � b1

Two-party conjunction: as seen by C

19

|[

]|


c0 := b2 � c � b1 reveal c0

Two-party conjunction: multiple views

;;

reveal b ∧ c

specificationvisB Bool b

visB Bool b1, b2

visC Bool c

visC Bool c0

implementation

20

The tale of the Three Judges

Reveal the majority verdict.

Do not reveal individual verdicts to anyone.

specification

secure refinement

reveal (a + b + c ≥ 2)

visA {0, 1} avisB {0, 1} bvisC {0, 1} c

21

a+b+c ≥ 2≡ a ∧ (b ∨ c) ∨ b ∧ c



a+b+c ≥ 2≡ a ∧ (b ∨ c) ∨ b ∧ c

≡ b ∨ c � a � b ∧ c



a+b+c ≥ 2≡ a ∧ (b ∨ c) ∨ b ∧ c

≡ b ∨ c � a � b ∧ c



A shortcut.

The tale of the Three Judges:


First attempt

if a

thenreveal (a + b + c ≥ 2)else

fi

But watch out... We will return to this.

24

reveal b ∧ c

reveal b ∨ c

The tale of the Three Judges: First attempt

if a

thenelse

fi

25

¬(¬b ∧ ¬c)reveal b ∧ c

reveal b ∨ c


if a

thenelse

fi

25

reveal b ∧ c

reveal b ∨ c


if a

thenelse

fi

26

reveal b ∨ c


if a

thenelse

fi27

reveal b ∨ c


if a

thenelse

fi

b1 ⊕ b2 := b

c0 := b2 � c � b1

27

reveal b ∨ c


if a

thenelse

fi

b1 ⊕ b2 := b

c0 := b2 � c � b1

ab := b1

ac := c0

27

reveal b ∨ c


if a

thenelse

fi

b1 ⊕ b2 := b

c0 := b2 � c � b1

ab := b1

ac := c0

reveal ab ⊕ ac

visA ab, ac

visB b1, b2

visC c0

27


if a

then

visA ab, ac

visB b1, b2

visC c0

b1≡b2 := b

c0 := b2 � c � b1

ab := b1

ac := c0

reveal ab ⊕ ac

28


if a

then

visA ab, ac

visB b1, b2

visC c0

Oops! Agent B learns a by noting which protocol it is asked to follow.

b1≡b2 := b

c0 := b2 � c � b1

ab := b1

ac := c0

reveal ab ⊕ ac

28


if a

thenelse

fi

Because the two right-hand instances of prog can be manipulatedindependently, the Shadow semantics does not allow this equality.

progprog

prog

�=

29



First attempt

if a

thenreveal (a + b + c ≥ 2)else

fi


�=

Not allowed.

30

?=



“Get both b ∨ c and b ∧ c”reveal (b ∨ c) � a � (b ∧ c)

This way, Agent B cannot tell which of the propositions Agent A actually wants.

31

?=



Second attempt


This way, Agent B cannot tell which of the propositions Agent A actually wants.

31

�=



Second attempt


Oops! Agent A learns both b∨c and b∧c.

32

visA ab, ac

visB b∧, b∨visC c∧, c∨



b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

ac := (c∨ � a � c∧)ab := (b∨ � a � b∧)

reveal ab ⊕ ac

=

33

visA ab, ac




Correctrefinement

b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

ac := (c∨ � a � c∧)ab := (b∨ � a � b∧)

reveal ab ⊕ ac

=

33

Variable’s name indicates its owner;its subscript indicates its purpose.

visA ab, ac




Correctrefinement

b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

ac := (c∨ � a � c∧)ab := (b∨ � a � b∧)

reveal ab ⊕ ac

=

None of Agents A,B,C learns anything about b∨c from this.

34

visA ab, ac




Correctrefinement

b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

ac := (c∨ � a � c∧)ab := (b∨ � a � b∧)

reveal ab ⊕ ac

=

None of Agents A,B,C learns anything about b∧c from this.

35

visA ab, ac




Correctrefinement

b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

ac := (c∨ � a � c∧)ab := (b∨ � a � b∧)

reveal ab ⊕ ac

=

Agent A learns nothing about “the other” b; and Agent B learns nothing about a.

36

visA ab, ac




Correctrefinement

b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

ac := (c∨ � a � c∧)ab := (b∨ � a � b∧)

reveal ab ⊕ ac

=

Agent A learns nothing about “the other” c; and Agent C learns nothing about a.

37

visA ab, ac




Correctrefinement

b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

ac := (c∨ � a � c∧)ab := (b∨ � a � b∧)

reveal ab ⊕ ac

=

In spite of all that, the verdict (a+b+c ! 2) is revealed at this point.

38



Correctrefinement

= (b∨≡b�∨) := b;c∨ := (b�∨ � c � b∨);(b∧⊕b�∧) := b;c∧ := (b�∧ � c � b∧);ab := (b∨ � a � b∧);ac := (c∨ � a � c∧);reveal ab ⊕ ac

39



Correctrefinement

= (b∨≡b�∨) := b;c∨ := (b�∨ � c � b∨);(b∧⊕b�∧) := b;c∧ := (b�∧ � c � b∧);ab := (b∨ � a � b∧);ac := (c∨ � a � c∧);reveal ab ⊕ ac

40



Correctrefinement

= (b∨≡b�∨) := b;c∨ := Lorem ipsum dolor

sit amet, consecteturadipisicing elit, seddo eiusmod temporincididunt ut labore etdolore magna aliqua.

(b∧⊕b�∧) := b;c∧ := Lorem ipsum dolor

sit amet, consecteturadipisicing elit, seddo eiusmod temporincididunt ut labore etdolore magna aliqua.

ab := Lorem ipsum dolorsit amet, consecteturadipisicing elit, seddo eiusmod temporincididunt ut labore etdolore magna aliqua.

ac := Lorem ipsum dolorsit amet, consecteturadipisicing elit, seddo eiusmod temporincididunt ut labore etdolore magna aliqua.

41



Correctrefinement

=

(b∨≡

b� ∨)

:=b;

c ∨:=

Lore

mip

sum

dolo

rsi

tam

et,co

nsec

tetu

rad

ipis

icin

gel

it,se

ddo

eius

mod

tem

por

inci

didu

ntut

labo

reet

dolo

rem

agna

aliq

ua.

(b∧⊕

b� ∧)

:=b;

c ∧:=

Lore

mip

sum

dolo

rsi

tam

et,co

nsec

tetu

rad

ipis

icin

gel

it,se

ddo

eius

mod

tem

por

inci

didu

ntut

labo

reet

dolo

rem

agna

aliq

ua.

a b:=

Lore

mip

sum

dolo

rsi

tam

et,co

nsec

tetu

rad

ipis

icin

gel

it,se

ddo

eius

mod

tem

por

inci

didu

ntut

labo

reet

dolo

rem

agna

aliq

ua.

a c:=

Lore

mip

sum

dolo

rsi

tam

et,co

nsec

tetu

rad

ipis

icin

gel

it,se

ddo

eius

mod

tem

por

inci

didu

ntut

labo

reet

dolo

rem

agna

aliq

ua.

41

“Source-level proof”

Judgesthe ThreeThe tale of :


Correctrefinement

b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

ac := (c∨ � a � c∧)ab := (b∨ � a � b∧)

reveal ab ⊕ ac

=

42

“This-level proof”

The subprotocols’ proofs are (will be one day) off-the-shelf, and need not be repeated

for specific applications.

Judgesthe Three

43

The taleof

Judgesthe Three

43

Judge A

Judge B Judge C

The taleof

initialisation

Private communications.

initialisation

The tale the Threeof Judges

44

Judge A

Judge B Judge C


44

Judge A

Judge B Judge C


45

Judge A

Judge B Judge C


46

Judge A

Judge B Judge C


47

Judge A

Judge B Judge C


48

Judge A

Judge B Judge C


49

Judge A

Judge B Judge C

?

? ?

ready to judge


49

Judge A

Judge B Judge C

a

b c


50

Judge A

Judge B Judge C

a

b c

assemble the verdict


50

Judge A

Judge B Judge C

a

bcb⋁



50

Judge A

Judge B Judge C

a

bcb⋁


Public communications.


51

Judge A

Judge B Judge C

a

bcb⋁


Public communications.


52

Judge A

Judge B Judge C

a

bcb⋁



52

Judge A

Judge B Judge C

a

b cb⋁ c⋁



53

Judge A

Judge B Judge C

a

b cb⋁ c⋁


53

Judge A

Judge B Judge C

a

b cb⋁ c⋁b⋀ c⋀


54

Judge A

Judge B Judge C

a



54

Judge A

Judge B Judge C

a


ab


55

Judge A

Judge B Judge C

a


ab


55

Judge A

Judge B Judge C

a


ab ac

The tale of

56

Judge A

Judge B Judge C

a


ab ac

Judge A now knows the majority verdict;

before this point, no-one* knew more

than their own judgement

even though all green messages

were public.*except Sheherazade


57

Judge A

Judge B Judge C

a


ab ac

announce the outcome:the defendant will rise...


58

Judge A

Judge B Judge C

a


ab ⨁ ac


59

Judge A

Judge B Judge C

a


ab ⨁ ac

ab ac


60

Judge A

Judge B Judge C

a


(a+b+c) ! 2

ab ac


61

Judge A

Judge B Judge C

a

b c

(a+b+c) ! 2

Appendix

Derivation of The Three Judges •

Derivation of Oblivious Transfer •

Derivation of the Encryption Lemma •

62

The Encryption Lemma derivation

|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1

63

var Bool b


|[

]|

hid Bool b1, b2

b1 ⊕ b2 := b

reveal b1

64

var Bool b

b1 := b⊕ b2

b2:∈ {0, 1}


|[

]|

hid Bool b1, b2

reveal b1

65

var Bool b


|[

]|

hid Bool b1, b2

reveal b1

b1:∈ {0, 1}b2 := b⊕ b1

66

var Bool b


|[

]|

hid Bool b1, b2

reveal b1

b1:∈ {0, 1}b2 := b⊕ b1

67

var Bool b

b1:∈ {0, 1}


|[

]|reveal b1

hid Bool b1

68

var Bool b


skip

69

var Bool b

Appendix




70

visB b

visA a

The Three-Judges derivation

visC c

reveal (a+b+c ≥ 2)

71

visB bvisA a


visC c


72

visB bvisA a


visC c


visB b∧;visC c∧b∧ ⊕ c∧ := b ∧ c

|[

]|

Lovers’ Protocol

73

A: trivial.B,C: EL.

visB bvisA a


visC c


visB b∧;visC c∧

b∧ ⊕ c∧ := b ∧ c

|[

74

visB bvisA a


visC c


visB b∧;visC c∧

b∧ ⊕ c∧ := b ∧ c

|[

b∨ ⊕ c∨ := b ∨ c

visB b∨;visC c∨

75

A: trivial.B,C: EL.

visB bvisA a


visC cvisB b∧;visC c∧

b∧ ⊕ c∧ := b ∧ c

|[

b∨ ⊕ c∨ := b ∨ c

visB b∨;visC c∨

ab ⊕ ac := (a+b+c ≥ 2)reveal ab ⊕ ac

visA ab, ac

76

A: reveal.B,C: trivial.

ab ⊕ ac := (b∨⊕c∨ � a � b∧⊕c∧)

visB bvisA a



b∧ ⊕ c∧ := b ∧ c

|[

b∨ ⊕ c∨ := b ∨ c

visB b∨;visC c∨

reveal ab ⊕ ac

visA ab, ac

77

prop calcprog alg

ab ⊕ ac := (b∨ � a � b∧)⊕ (c∨ � a � c∧)

visB bvisA a



b∧ ⊕ c∧ := b ∧ c

|[

b∨ ⊕ c∨ := b ∨ c

visB b∨;visC c∨

reveal ab ⊕ ac

visA ab, ac

78

prop calc

ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)

visB bvisA a



b∧ ⊕ c∧ := b ∧ c

|[

b∨ ⊕ c∨ := b ∨ c

visB b∨;visC c∨

reveal ab ⊕ ac

visA ab, ac

79

ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)

visB bvisA a



b∧ ⊕ c∧ := b ∧ c

|[

b∨ ⊕ c∨ := b ∨ c

visB b∨;visC c∨

reveal ab ⊕ ac

This resolution of nondeterminism is not valid on its own.

visA ab, ac

79

ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)

visB bvisA a



b∧ ⊕ c∧ := b ∧ c

|[

b∨ ⊕ c∨ := b ∨ c

visB b∨;visC c∨

reveal ab ⊕ ac


visA ab, ac

79

ab ⊕ ac := (b∨ � a � b∧)⊕ (c∨ � a � c∧)

ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

For B,C it is invalid because it resolves hidden nondeterminism in the A-variables.


80

ab ⊕ ac := (b∨ � a � b∧)⊕ (c∨ � a � c∧)

ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

For B,C it is invalid because it resolves hidden nondeterminism in the A-variables.

For A it is invalid because it reveals information about the separate halves of the exclusive-or.


81


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

B,C’s point of view.visB bvisA a

visC cvisB b∧;visC c∧|[visB b∨;visC c∨

ab ⊕ ac := (b∨ � a � b∧)⊕ (c∨ � a � c∧)

visA ab, ac

82


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac



ab ⊕ ac := (b∨ � a � b∧)⊕ (c∨ � a � c∧)

visA ab, ac

82

ab ⊕ ac := ab ⊕ ac


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac


visC cvisB b∧;visC c∧|[visB b∨;visC c∨visA ab, ac

83


ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac



84


ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)

]|


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac



85

ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

visB bvisA a

visC cvisB b∧;visC c∧|[

ab ⊕ ac := (b∨ � a � b∧)⊕ (c∨ � a � c∧)

visA ab, ac

86

A’s point of view,when a is true.

visAB b∨;visAC c∨

A: revealnot “trivial”


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

visB bvisA a


visA ab, ac

87



ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)

A: standard refinement


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

visB bvisA a


visA ab, ac

87



ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)

A: standard refinement

ab ⊕ ac := (b∨ � a � b∧)⊕ (c∨ � a � c∧)


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

visB bvisA a


visA ab, ac

88


ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)

A: reduce visibility

visB b∨;visC c∨


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

visB bvisA a


visA ab, ac

89

ab, ac := (b∨ � a � b∧), (c∨ � a � c∧)

A: symmetry

visB b∨;visC c∨

A’s point of view,when a is true and,by symmetry,false too.


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

An alternative is to consider the three statements together.

visB bvisA a


ab ⊕ ac := (b∨ � a � b∧)⊕ (c∨ � a � c∧)

visA ab, ac

90


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

The case-analysis is avoided; but it becomes less algebraic.

visB bvisA a


91

ab ac (b∨ � a � b∧) (c∨ � a � c∧):=, ,

macro-atomicity


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

visB bvisA a


92

ab ac (b∨ � a � b∧) (c∨ � a � c∧), := ,


b∧ ⊕ c∧ := b ∧ c

b∨ ⊕ c∨ := b ∨ c

reveal ab ⊕ ac

visB bvisA a


93

ab

ac

(b∨ � a � b∧)(c∨ � a � c∧)

:=:=

Macro-atomicity

Let «P» mean “program fragment P executed atomically: ephemeral visibles not seen, nor interior control flow.”

94

Macro-atomicity


94

1. For classical primitive statement S we have «S» = S. This is by definition of primitive statements’ semantics.

Macro-atomicity


94

1. For classical primitive statement S we have «S» = S. This is by definition of primitive statements’ semantics.

2. For fragments P,Q we have «P»;«Q» ⊑ «P;Q». This is by definition of «•». Informally, it is because the ephemerals are visible at left but hidden at right.

Macro-atomicity


95

1. For classical primitive statement S we have «S» = S.2. For fragments P,Q we have «P»;«Q» ⊑ «P;Q».

Informally, it is because the intermediates’ being inferred means that hiding them has no effect.

3. For fragments P,Q we have «P»;«Q» = «P;Q» provided the intermediate visibles can be inferred from the external visibles.

Macro-atomicity


96


Trivial.4. For fragments P,Q we have P = Q implies «P» = «Q».


Macro-atomicity


97


4. For fragments P,Q we have P = Q implies «P» = «Q».

If two straight-line primitive sequences S1;S2;...;SM and T1;T2;...;TN are equal classically, and no visible is assigned-to twice at right, then the sequences are security-equal as well.


Appendix




98

Oblivious transfer

ab := (b∨ � a � b∧)visB b∨, b∧

visA a, ab

99

Oblivious transfer

ab := (b∨ � a � b∧)

visB b∨, b∧

visA a, ab

100

Oblivious transfer

ab := (b∨ � a � b∧)

visB b∨, b∧

visA a, ab

|[

]|

a�:∈ {0, 1}vis x;visA a�

x := a⊕ a�

Encryption Lemma

101

Oblivious transfer

ab := (b∨ � a � b∧)

visB b∨, b∧

visA a, ab

|[

a�:∈ {0, 1}vis x;visA a�x := a⊕ a�

102

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

ab := (b∨ � a � b∧)

a�:∈ {0, 1}x := a⊕ a�

visB b�0, b

�1

b�0:∈ {0, 1}; b�

1:∈ {0, 1}

vis y∨, y∧

]|

Encryption Lemma twice

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

|[

103

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

ab := (b∨ � a � b∧)

a�:∈ {0, 1}x := a⊕ a�

visB b�0, b

�1

b�0:∈ {0, 1}; b�

1:∈ {0, 1}

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

104

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

ab := (b∨ � a � b∧)

a�:∈ {0, 1}x := a⊕ a�

visB b�0, b

�1

b�0:∈ {0, 1}; b�

1:∈ {0, 1}

vis y∨, y∧

EL

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

104

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

ab := (b∨ � a � b∧)

a�:∈ {0, 1}

x := a⊕ a�

b�0:∈ {0, 1}; b�

1:∈ {0, 1}

visB b�0, b

�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

105

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

ab := (b∨ � a � b∧)

a�:∈ {0, 1}

x := a⊕ a�

b�0:∈ {0, 1}; b�

1:∈ {0, 1}

All three variables are visible to everyone; but they learn nothing at all from them.

visB b�0, b

�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

105

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

ab := (b∨ � a � b∧)

x := a⊕ a�

All three variables are visible to everyone; but they learn nothing at all from them.

a�:∈ {0, 1}b�0:∈ {0, 1}; b�

1:∈ {0, 1}

visB b�0, b

�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

And yet...

106

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

x := a⊕ a�

a�:∈ {0, 1}b�0:∈ {0, 1}; b�

1:∈ {0, 1}

visB b�0, b

�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

107

ab := (b∨ � a � b∧)

ab := (y∨⊕b�¬x � a � y∧⊕b�x)

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

x := a⊕ a�

a�:∈ {0, 1}b�0:∈ {0, 1}; b�

1:∈ {0, 1}

visB b�0, b

�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

108

ab := (y∨⊕b�a� � a � y∧⊕b�a�)

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

x := a⊕ a�

a�:∈ {0, 1}b�0:∈ {0, 1}; b�

1:∈ {0, 1}

visB b�0, b

�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

109

ab := (y∨ � a � y∧)⊕ b�a�

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

x := a⊕ a�

a�:∈ {0, 1}b�0:∈ {0, 1}; b�

1:∈ {0, 1}

visB b�0, b

�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

110

ab := (y∨ � a � y∧)⊕ b�a�

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

x := a⊕ a�

Both visible to A

a�:∈ {0, 1}b�0:∈ {0, 1}; b�

1:∈ {0, 1}

visB b�0, b

�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

110

ab := (y∨ � a � y∧)⊕ a��

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

x := a⊕ a�

a�� := b�a�

visA a��

a�:∈ {0, 1}b�0:∈ {0, 1}; b�

1:∈ {0, 1}

visB b�0, b

�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

111

a�� := (b�1 � a� � b�

0)

ab := (y∨ � a � y∧)⊕ a��

y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

x := a⊕ a�

visA a��

a�:∈ {0, 1}b�0:∈ {0, 1}; b�

1:∈ {0, 1}

visB b�0, b

�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

112

a�� := (b�1 � a� � b�

0)

ab := (y∨ � a � y∧)⊕ a��y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

x := a⊕ a�visA a��

a�:∈ {0, 1}b�0:∈ {0, 1}; b�

1:∈ {0, 1}

visB b�0, b

�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

113

a�� := (b�1 � a� � b�

0)

ab := (y∨ � a � y∧)⊕ a��y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

Oblivious transfer

a�:∈ {0, 1}

x := a⊕ a�

b�0:∈ {0, 1}; b�

1:∈ {0, 1}

visA a��visB b�

0, b�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

114

a�� := (b�1 � a� � b�

0)

ab := (y∨ � a � y∧)⊕ a��y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

a�:∈ {0, 1}

x := a⊕ a�

b�0:∈ {0, 1}; b�

1:∈ {0, 1}

Done in advance, by a trusted third party


0, b�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

Oblivious transfer

115

a�� := (b�1 � a� � b�

0)

ab := (y∨ � a � y∧)⊕ a��y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

a�:∈ {0, 1}

x := a⊕ a�

b�0:∈ {0, 1}; b�

1:∈ {0, 1}


0, b�1

vis y∨, y∧

visB b∨, b∧

visA a, ab

|[ vis x;visA a�

At first, prepare...

116

a�� := (b�1 � a� � b�

0)

ab := (y∨ � a � y∧)⊕ a��y∧ := b∧ ⊕ b�x

y∨ := b∨ ⊕ b�¬x

a�:∈ {0, 1}

x := a⊕ a�

b�0:∈ {0, 1}; b�

1:∈ {0, 1}

Later...

visB b�0, b

�1

visB b∨, b∧

visA a, ab

|[

The actual transfer

vis x, y∨, y∧

visA a�, a��

117

Appendix




118

Sheherazade’s Tale of the Three Judges

Documents

Transcript of Sheherazade’s Tale of the Three Judges